Branch Protection — Expected Settings for main

This document records the expected branch-protection configuration for the main branch of l2_fcc_agent_team_ext. GitHub does not accept branch-protection rules from a file in the repository; the owner applies these settings through the GitHub UI (Settings → Branches → Branch protection rules). This file is the documented source of truth that the UI state is periodically reconciled against. When the owner changes a rule in the UI, this file should be updated in the same PR that introduces the change (or in an immediate follow-up).

Applies to

• Branch pattern: main
• Repository: rollingthunderfourtytwo-afk/l2_fcc_agent_team_ext

Required settings

1. Require a pull request before merging

• Enabled: yes
• Required approving reviews: 1
• Dismiss stale pull-request approvals when new commits are pushed: yes
• Require review from Code Owners: yes (uses ./CODEOWNERS)
• Require approval of the most recent push: yes

2. Require status checks to pass before merging

• Enabled: yes
• Require branches to be up to date before merging: yes

Required status checks (must be green before merge):

Check name	Workflow	Required?
tests	ci.yml	yes
lint	ci.yml	yes
coverage-gate (99%)	ci.yml	yes
mkdocs build	docs.yml	yes
Analyze (python)	codeql.yml	yes
ecosystem-integration	ecosystem-integration.yml	advisory (non-blocking)
ice-ext-integration	(v1.4.1+)	advisory (non-blocking)
vocabulary-drift	(v1.4.2+)	required from v1.4.2

"Advisory" checks are run on every PR and reported on the status page, but they do not block merge. They are promoted to "required" once the underlying signal is stable (see release notes for each version bump).

3. Require conversation resolution before merging

• Enabled: yes. All review comments must be resolved before merge.

4. Require signed commits

• Recommended: yes. Documented here as an expectation but not programmatically enforced today, to keep the bar low for first-time contributors. Maintainer commits should be GPG- or Sigstore-signed.

5. Include administrators

• Enabled: yes. Admins are subject to the same rules as everyone else; bypass requires explicitly unticking this box and leaves an audit trail.

6. Restrict who can push to matching branches

• Enabled: yes. Only the repository owner and GitHub Actions bots with explicit write scope may push. All other changes must arrive via PR.

7. Allow force pushes / deletions

• Force pushes: disabled
• Deletions: disabled

8. Lock branch

• Not enabled. main remains writable via PR.

Rationale

These settings mirror the conventions used across the FCC constellation (ophiuchus, serpens, libra, crater, scutum, norma, pyxis, vela, columba, caelum). Matching rules across the ecosystem make cross-repo reviews predictable and make it easier to rotate contributors between projects without re-learning per-repo norms.

Maintenance

• Review this file whenever a new required CI job is added (promote from advisory to required, or add a new row).
• When a CI workflow is renamed, update the Workflow column and the matching branch-protection rule name in the UI.
• When a new status gate ships in a release (e.g. vocabulary-drift in v1.4.2), the release PR should flip the Required? column here and in the GitHub UI in the same change window.

Explicit note

The owner applies these settings via the GitHub UI; this file is the documented expected state. Drift between this file and the live UI configuration is itself a bug and should be reported via the ecosystem-drift issue template.